Network simulation apparatus and method for analyzing abnormal network

• US 20060109793A1
• Filed: 05/06/2005
• Published: 05/25/2006
• Est. Priority Date: 11/25/2004
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Seo, Dong Il, Kim, Hwan Kuk, Choi, Yang Seo
• Application Number:
  US11/123,278
• Publication Number:
  US 20060109793A1
• Time in Patent Office: Days
• US Class Current: 370/250
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A network simulation apparatus and method for analyzing abnormal network traffic are provided. The network simulation apparatus includes: a traffic information collection unit, which collects traffic information in real time from a network; a simulator, which performs a simulation operation in a virtual network topology environment according to a predetermined scenario, the virtual network topology environment generating virtual traffic including a normal virtual packet modeled based on a normal traffic environment and an abnormal virtual packet modeled based on an abnormal traffic environment with a network traffic attack launched thereupon based on the collected real-time traffic information; and an interface unit, which provides the simulation operation results to a user. Accordingly, it is possible to effectively detect, analyze, and deal with abnormal network traffic that has occurred in a network to be managed.

Claims

1. A network simulation apparatus for analyzing abnormal network traffic comprising:

a traffic information collection unit, which collects traffic information in real time from a network;

a simulator, which performs a simulation operation in a virtual network topology environment according to a predetermined scenario, the virtual network topology environment generating virtual traffic including a normal virtual packet modeled based on a normal traffic environment and an abnormal virtual packet modeled based on an abnormal traffic environment with a network traffic attack launched thereupon based on the collected real-time traffic information; and

an interface unit, which provides the simulation operation results to a user.

2. The network simulation apparatus of claim 1, wherein the traffic information collection unit converts the collected real-time traffic information to be compatible with the virtual network topology environment.

3. The network simulation apparatus of claim 1, wherein the simulator comprises:

a traffic statistics database, which stores the collected real-time traffic information received from the traffic information collection unit;

a virtual network topology generator, which creates the virtual network topology environment through modeling of virtual network elements;

a simulation execution script generator, which creates the virtual traffic based on the collected real-time traffic information stored in the traffic statistics database and defines an event schedule;

a simulation engine, which performs a simulation operation on the virtual traffic in the virtual network topology environment created by the virtual network topology generator according to the event schedule defined by the simulation execution script generator; and

an abnormal traffic analyzer, which analyzes abnormal network traffic by comparing the simulation operation results with statistical values related to the collected real-time traffic information.

4. The network simulation apparatus of claim 1, wherein the virtual network topology environment comprises an attacker node, a traffic control node, and a security management node as the virtual network elements,

wherein the attacker node creates the virtual traffic based on the collected real-time traffic information,

the traffic control node controls abnormal network traffic caused by the abnormal virtual packet or control network bandwidths according to a predetermined security policy when it detects the abnormal network traffic, and

the security management node establishes the predetermined security policy and transmits it to the traffic control node when the traffic control node detects the abnormal network traffic.

5. The network simulation apparatus of claim 4, wherein the traffic control node comprises a traffic control agent, which creates a warning message and transmits it to the security management node when the traffic control node detects the abnormal network traffic, and the security management node comprises a security management agent, which establishes a security policy, including controlling the abnormal network traffic or network bandwidths, and transmits it to the traffic control node.

6. The network simulation apparatus of claim 5, wherein operating states of the traffic control agent comprise:

an initial state in which the traffic control agent stands by to receive a virtual packet;

a virtual packet reception state in which the traffic control agent determines whether a received virtual packet is an abnormal packet;

a security policy storage state in which the traffic control agent stores the security policy if the received virtual packet is an abnormal packet;

an abnormal network traffic detection state in which the traffic control agent establishes a security policy for dealing with the abnormal network traffic according to the security policy stored in the security policy storage state; and

a termination state in which the traffic control agent carries out the security policy established in the abnormal network traffic detection state.

7. The network simulation apparatus of claim 5, wherein operating states of the security management agent comprise:

an initial state in which the security management agent stands by to receive a virtual packet;

a virtual packet reception state in which the security management agent determines whether a received virtual packet is related to a warning message created by the traffic control agent;

a security policy determination state in which the security management agent establishes a security policy for controlling abnormal network traffic or network bandwidths if the received virtual packet is related to the warning message created by the traffic control agent; and

a termination state in which the security management agent transmits the established security policy to the traffic control agent.

8. A network simulation method for analyzing abnormal network traffic comprising:

collecting traffic information in real time from a network;

performing a simulation operation in a virtual network topology environment according to a predetermined scenario, the virtual network topology environment generating virtual traffic including a normal packet modeled based on a normal traffic environment and an abnormal packet modeled based on an abnormal traffic environment with a network traffic attack launched thereupon based on the collected real-time traffic information; and

providing the simulation operation results to a user.

9. The network simulation method of claim 8, wherein the collecting of the real-time traffic information comprises converting the collected real-time traffic information to be compatible with the virtual network topology environment.

10. The network simulation method of claim 8, wherein the performing of the simulation operation comprises:

creating the virtual traffic based on the collected real-time traffic information stored in the traffic statistics database and defining an event schedule;

creating the virtual network topology environment through modeling of virtual network elements;

performing a simulation operation on the virtual traffic in the virtual network topology environment according to the defined event schedule; and

analyzing abnormal network traffic by comparing the simulation operation results with statistical values related to the collected real-time traffic information.

11. A computer-readable recording medium storing a computer program for executing the network simulation method of claim 8.